mivita/app/Http/Controllers/Web/CustomerEmailChangeController.php

<?php

namespace App\Http\Controllers\Web;

use App\Http\Controllers\Controller;
use App\Services\CustomerEmailChangeService;
use Illuminate\Contracts\View\View;

/**
 * Login-free confirmation of a new customer e-mail address via the tokenized link in the
 * confirmation mail. GET only shows the page; the change is applied on POST, so mail
 * scanners that open links cannot confirm on the customer's behalf.
 */
class CustomerEmailChangeController extends Controller
{
    public function show(string $token, CustomerEmailChangeService $service): View
    {
        $change = $service->findConfirmable($token);
        if (! $change) {
            return view('portal.customer.email_change_done', ['status' => CustomerEmailChangeService::STATUS_INVALID]);
        }

        if ($change->shopping_user && $service->ownershipConflict($change->shopping_user, $change->new_email)) {
            return view('portal.customer.email_change_done', ['status' => CustomerEmailChangeService::STATUS_CONFLICT]);
        }

        return view('portal.customer.email_change_confirm', [
            'change' => $change,
            'token' => $token,
        ]);
    }

    public function store(string $token, CustomerEmailChangeService $service): View
    {
        $change = $service->findConfirmable($token);
        $status = $change ? $service->confirm($change) : CustomerEmailChangeService::STATUS_INVALID;

        return view('portal.customer.email_change_done', [
            'status' => $status,
            'email' => $status === CustomerEmailChangeService::STATUS_CONFIRMED ? $change->new_email : null,
        ]);
    }
}